Bug bounty program

Kubernetes

Platform: HackerOne
Bounties: Pays
Assets in scope: 82
Disclosed reports: 77
Subdomains: 662
Vendor on CyberSIXT: Kubernetes (120 CVEs, 0 exploited)

Most upvoted reports77

Most upvoted reports of Kubernetes
Report	Weakness	Disclosed	Bounty	Votes
Node disk DOS by writing to container /etc/hostsAnalysed#867699	Denial of Service	2020-07-22	$1,000	161
Injection in path parameter of Ingress-nginxAnalysed#2701701	Command and Code Injection	2026-03-07	–	91
elections.k8s.io uses weak session secret key, may place elections at riskAnalysed#1387366	Cryptography	2025-09-19	$250	86
Bypass validation parts in AWS IAM Authenticator for KubernetesAnalysed#1580493	Authentication	2023-05-25	$2,500	68
CVE-2023-5528: Insufficient input sanitization in in-tree storage plugin leads to privilege escalation on Windows nodesAnalysed#2231019	Command and Code Injection	2023-12-21	$5,000	67
Subdomain Takeover Via via Dangling NS records on Amazon Route 53 http://api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.ioAnalysed#746000	Authentication	2020-11-29	$250	62
Ingress nginx annotation injection causes arbitrary command executionAnalysed#1728174	Command and Code Injection	2023-11-24	$2,500	57
Authenticated kubernetes principal with restricted permissions can retrieve ingress-nginx serviceaccount token and secrets across all namespacesAnalysed#1249583	Access Control	2021-12-04	–	55
Privilege Escalation in kOps using GCE/GCP ProviderAnalysed#1842829	Access Control	2023-08-04	$2,500	52
SSRF vulnerability can be exploited when a hijacked aggregated api server such as metrics-server returns 30XAnalysed#1544133	Server-Side Request Forgery	2022-12-10	$1,000	51

Weaknesses of its reports

In scope

Source code72 assetsgithub.com/kubernetes-csi · github.com/kubernetes-retired · https://github.com/kubernetes-client · https://github.com/kubernetes-incubator · https://github.com/kubernetes-security · https://github.com/kubernetes-sigs · https://github.com/kubernetes/api · https://github.com/kubernetes/apiextensions-apiserver
Other assets6 assetsCommunity Management & Communications · Tier 1 · Tier 2 · Tier 3 · https://storage.googleapis.com/kubernetes-release/ · k8s.gcr.io
Web applications4 assetsk8s.io · kubernetes-csi.github.io · kubernetes.io · prow.k8s.io

Subdomains662

Root

Scope

Name suggests:Staging

First seen

Text fileClear filters38 names

Subdomains of Kubernetes
Name	Scope	First seen
beta.gcr.iostaging	Not in the scope	2026-11-14
stage.gcr.iostaging	Not in the scope	2026-11-14
preview.gcr.iostaging	Not in the scope	2026-11-14
staging.gcr.iostaging	Not in the scope	2026-11-14
k8s-staging.gcr.iostaging, tools	Not in the scope	2026-11-14
staging-k8s.gcr.iostaging, tools	Not in the scope	2026-11-14
canary.k8s.iostaging	Not in the scope	2026-11-14
cs-canary.k8s.iostaging	Not in the scope	2026-11-14
prow-canary.k8s.iostaging	Not in the scope	2026-11-14
slack-staging.k8s.iostaging	Not in the scope	2026-11-14
feature.canary.k8s.iostaging	Not in the scope	2026-11-14
perf-dash-canary.k8s.iostaging, test	Not in the scope	2026-11-14
dranet.sigs.canary.k8s.iostaging	Not in the scope	2026-11-14
kindnet.sigs.canary.k8s.iostaging	Not in the scope	2026-11-14
monitoring.prow-canary.k8s.iomonitoring, staging	Not in the scope	2026-11-14
node-perf-dash-staging.k8s.iostaging, test	Not in the scope	2026-11-14
v1alpha1.cluster-api.sigs.k8s.ioapi, staging	Not in the scope	2026-11-14
kube-network-policies.sigs.canary.k8s.iostaging, tools	Not in the scope	2026-11-14
api.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.ioapi, staging, test	Not in the scope	2026-11-14
api.internal.e2e-kops-aws-canary.test-cncf-aws.k8s.ioapi, internal, staging, test	Not in the scope	2026-11-14
delegateapi.e2e-kops-aws-canary.test-cncf-aws.canary.k8s.iostaging, test	Not in the scope	2026-11-14
antivirusexceptionsoztips.beta.billing.bid.redirect2.kubectl.docs.k8s.iostaging	Not in the scope	2026-11-14
beta.kubernetes.iostaging	Not in the scope	2026-11-14
alpha.kubernetes.iostaging	Not in the scope	2026-11-14
dl.canary.kubernetes.iostaging	Not in the scope	2026-11-14
dns.alpha.kubernetes.iostaging	Not in the scope	2026-11-14
volume.beta.kubernetes.iostaging	Not in the scope	2026-11-14
service.beta.kubernetes.iostaging	Not in the scope	2026-11-14
volume.alpha.kubernetes.iostaging	Not in the scope	2026-11-14
kubeadm.alpha.kubernetes.iostaging	Not in the scope	2026-11-14
emptypod.alpha.kubernetes.iostaging	Not in the scope	2026-11-14
feature.canary.kubernetes.iostaging	Not in the scope	2026-11-14
scheduler.alpha.kubernetes.iostaging	Not in the scope	2026-11-14
u003eservice.beta.kubernetes.iostaging	Not in the scope	2026-11-14
failure-domain.beta.kubernetes.iostaging	Not in the scope	2026-11-14
seccomp.security.alpha.kubernetes.iostaging	Not in the scope	2026-11-14
nseccomp.security.alpha.kubernetes.iostaging	Not in the scope	2026-11-14
container.seccomp.security.alpha.kubernetes.iostaging	Not in the scope	2026-11-14

2 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.